HP Enterprise fixes 72 flaws in Aruba Wi-Fi network software

Hewlett Packard Enterprise (HPE) has released security updates for 72 flaws in ArubaOS, the software that runs its Aruba business Wi-Fi equipment. Eight of them got the highest severity rating. They could let an outsider skip the login or run their own commands on the device, with no password needed.

What changed

ArubaOS, also called AOS, powers Aruba Networking wireless systems used by organizations. That includes mobility conductors, access points, controllers and gateways. Access points are the boxes that send out the Wi-Fi signal. Controllers and gateways manage them and connect them to the rest of the network.

The eight worst flaws affect several versions of AOS-8 and AOS-10. HPE says attackers could use them from a distance, without any account, through low-complexity attacks. Nobody inside the company has to click anything for an attack to work.

HPE put it bluntly in its Thursday advisory. Customers are "strongly urged to patch their instances due to the complexity, breadth, and impact of these vulnerabilities."

Why it matters

Wi-Fi controllers sit at the center of an office network. A flaw that lets a stranger take over one is a serious problem, because that device can see and steer a lot of traffic. A login bypass means the lock on the front door does not work. Remote code execution means an attacker can run commands on the device as if they owned it.

Who can relax, and who cannot

If your business does not use Aruba wireless equipment, this advisory does not apply to you. If it does, check which software it runs. This notice covers AOS-8 and AOS-10. HPE has also warned separately about serious flaws in a different product line, AOS-CX, so an IT provider should look at both.

There is some good news. HPE says it has found no public exploit code and no sign that anyone is using these flaws in attacks. It said it is not aware of any public discussion of them as of the advisory date. That can change quickly once fixes are public, since attackers study updates to find what was broken.

What to do

The alert box above lists the steps. The short version is to confirm whether you use Aruba gear, install the update, and shut off easy access to the admin pages. HPE recommends keeping those pages on a dedicated network segment or behind firewall rules, with logging turned on to track who does what.

What happens next

The material does not say which exact versions are hit by each flaw. The full list is in HPE's advisory, which your IT provider should read. Watch for any report that attackers have begun using these bugs. HPE has faced similar problems before, including an Aruba access point flaw last July involving hardcoded passwords, so expect more updates to follow.